SOCI Act obligations

The Security of Critical Infrastructure Act 2018 (SOCI Act) sets legal obligations if you own, operate, or hold a direct interest in a critical infrastructure asset. The Cyber and Infrastructure Security Centre (CISC) is the regulator. What applies depends on your role and the asset class. This page is a high-level map, not a determination of whether you are in.

CISC describes three positive security obligations that can apply, depending on asset class: provide operational and ownership information to the Register of Critical Infrastructure Assets (Part 2); report cyber incidents that have a relevant or significant impact on the asset (Part 2B); and adopt, maintain and comply with a written risk management program (Part 2A). There is also an obligation to notify data service providers (s 12F(3)).

Mandatory cyber incident reporting goes to the ACSC. CISC's factsheet: an incident with a significant impact must be reported within 12 hours of the responsible entity becoming aware; an incident with a relevant impact within 72 hours. A verbal report must be followed by a written record through the ACSC site within 48 hours. One report can both notify and ask ACSC for help.

Assets declared Systems of National Significance carry Enhanced Cyber Security Obligations: incident response plans, cyber security exercises, vulnerability assessments, and providing system information so government can keep a near-real-time threat picture. Government assistance measures exist for incidents that would cause serious harm to Australia's prosperity, national security, or defence. They are last-resort tools, not a retainer.

If you think you might be a responsible entity, read the CISC obligation pages and the asset-class guidance. Do not guess yourself out of the Act. Do not treat a vendor questionnaire as a substitute for the register or the 12/72-hour clock.